I'd like to deploy a Canvas Connected App as part of a managed package and be able to dynamically assign users access to it via a Permission Set.

The Canvas App is using the Signed Request (Post) access method.

Under Manage Apps > Connected Apps > OAuth policies the Permitted Users have been set to "Admin approved users are pre-authorized". On the same screen a Permission Set has been added to the Connected App.

When the Permission Set and Canvas App are deployed as part of a managed package the Permitted Users resets to "All users may self-authorize" in the installing org.

After manually changing Permitted Users to "Admin approved users are pre-authorized" in the target org and attempting to add the managed permission set back to the Connected App I get the error:

Cannot Modify Managed Component
The component you are attempting to modify is part of a managed package, and cannot be modified. For more information, see Insufficient Privileges Errors.

Is this an explicit security restriction to ensure managed packages don't automatically grant users access?
I.e. Only an Admin in the local org can grant access to the App.

Based on App disappears from Permission Set included with package it appears to be a limitation of the packaging process rather than a specific security control.

From Special Behavior of Components in Packages

Permission Sets

You can include permission sets as components in a package, with the following permissions and access settings:

  • Custom object permissions
  • External data source access

Assigned apps and tab settings are not included in permission set components.

So the assigned apps aren't carried over on the permission set currently.

The idea Maintain App and Tab settings for Permission Sets in Managed Packages would be worth promoting.

That leaves the question - How can a managed package control user access to the deployed Connected App?

Maybe if the installing Admin creates a new Permission Set and configures it against the Connected app as a manual post install step. Then the Id of the Permission Set that grants access could be configured into the managed package for creating the PermissionSetAssignment records.

  • 1
  • 1
    were you eventually able to find a solution to this? Cloning the managed permission set and then assigning it works, but seems to defeat the purpose.
    – Mark Pond
    Jul 1, 2016 at 17:08
  • 1
    It's amusing and frustrating to find this question and see that I've walked this path before... and still there is no solution to the dilemma.
    – Mark Pond
    Mar 23, 2018 at 16:54
  • 1
    @DanielBallinger There may be hope! A new attribute is coming along with v46.0 called isAdminApproved, which when true mean's your Permitted Users setting is set to Admin approved. Interestingly enough, in the metadata, when you change from Admin approved to User approved, isAdminApproved changes to false and the metadata item <permissionSetName>My Connected App User</permissionSetName> also disappears. The reason why permission sets don't carry over is because the User approved setting is defaulted, which clears out the assigned permission sets Jul 4, 2019 at 18:24
  • 1
    See the new isAdminApproved attribute in the ConnectedApp Metadata Docs Jul 4, 2019 at 18:25

1 Answer 1


While it is not possible to work with packaged connected app and packaged permission set, we may consider the following two options.

  1. Use packaged connected app and unpackaged cloned permission set. It is possible to clone a packaged permission set or create unpackaged permission set via Apex Code like following

    PermissionSet ps = [SELECT Fields(Standard) FROM PermissionSet WHERE Name = 'PermissionName' AND NamespacePrefix = 'Namespace'];
    ps.Id = null;
    insert ps;

And you can use SetupEntityAccess to assign a permission set to a connected app.

Admin must manually set the packaged connected app settings to "Admin approved users are pre-authorized"

Then you can just save id or name of created unpackaged permission set and use it to grant access to your users by assigning it.

  1. Use unpackaged connected app and unpackaged cloned permission set.

It is possible to create a button in setup configuration interface for admin to authorize an app in a simple one-click way.

This button click may deploy a new local unmanaged Connected App, make it preapproved and send its Consumer Key to you.

Then you can just save id or name of created unpackaged permission set and use it to grant access to your users by assigning it.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .